High severity7.5NVD Advisory· Published Jul 14, 2026· Updated Jul 14, 2026
CVE-2026-10051
CVE-2026-10051
Description
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.eclipse.jetty:jetty-serverMaven | >= 12.0.0, < 12.0.36 | 12.0.36 |
org.eclipse.jetty:jetty-serverMaven | >= 12.1.0, < 12.1.10 | 12.1.10 |
Affected products
56- osv-coords54 versionspkg:apk/chainguard/solr-10-iamguarded-compatpkg:apk/chainguard/spark-fips-4.2-scala-2.13pkg:apk/chainguard/strimzi-kafka-operator-fips-kafka-initpkg:apk/chainguard/strimzi-kafka-operator-fips-topic-operatorpkg:apk/wolfi/strimzi-kafka-operator-tracing-agentpkg:apk/chainguard/spark-kubernetes-operatorpkg:apk/chainguard/strimzi-kafka-operator-fips-kafka-agentpkg:apk/chainguard/apache-hop-fipspkg:apk/chainguard/apache-jena-fusekipkg:apk/chainguard/jenkins-2.568-openjdk-21pkg:apk/chainguard/spark-4.2-scala-2.13pkg:apk/wolfi/akhqpkg:apk/wolfi/confluent-kafkapkg:apk/wolfi/dependency-trackpkg:apk/wolfi/strimzi-kafka-operator-kafka-initpkg:apk/wolfi/strimzi-kafka-operator-topic-operatorpkg:apk/chainguard/kafka-4.0pkg:apk/chainguard/kafka-fips-4.3pkg:apk/chainguard/neo4j-2026.03pkg:apk/chainguard/neo4j-2026.06pkg:apk/chainguard/neo4j-5.26pkg:apk/chainguard/reposilitepkg:apk/chainguard/strimzi-kafka-operator-fips-cluster-operatorpkg:apk/wolfi/neo4j-2026.06pkg:apk/chainguard/jenkins-2.568pkg:apk/chainguard/spark-kubernetes-operator-fipspkg:apk/chainguard/strimzi-kafka-operator-cluster-operatorpkg:apk/chainguard/strimzi-kafka-operator-fips-tracing-agentpkg:apk/chainguard/traccar-fipspkg:apk/wolfi/strimzi-kafka-operator-kafka-agentpkg:apk/chainguard/druidpkg:apk/chainguard/strimzi-kafka-operator-user-operatorpkg:apk/chainguard/akhqpkg:apk/chainguard/apache-hoppkg:apk/chainguard/confluent-kafkapkg:apk/chainguard/confluent-kafka-jre-bcfipspkg:apk/chainguard/dependency-trackpkg:apk/chainguard/solr-10pkg:apk/chainguard/solr-fips-10pkg:apk/chainguard/solr-fips-10-iamguarded-compatpkg:apk/chainguard/strimzi-kafka-operator-kafka-agentpkg:apk/chainguard/strimzi-kafka-operator-topic-operatorpkg:apk/chainguard/strimzi-kafka-operator-tracing-agentpkg:apk/chainguard/traccarpkg:apk/wolfi/dependency-track-bundledpkg:apk/wolfi/druidpkg:apk/wolfi/solr-10pkg:apk/wolfi/solr-10-iamguarded-compatpkg:apk/wolfi/strimzi-kafka-operator-cluster-operatorpkg:apk/wolfi/strimzi-kafka-operator-user-operatorpkg:apk/chainguard/dependency-track-bundledpkg:apk/chainguard/jenkins-2.568-openjdk-25pkg:apk/chainguard/strimzi-kafka-operator-fips-user-operatorpkg:apk/chainguard/strimzi-kafka-operator-kafka-init
< 10.0.0-r8+ 53 more
- (no CPE)range: < 10.0.0-r8
- (no CPE)range: < 4.2.0-r1
- (no CPE)range: < 1.1.0-r1
- (no CPE)range: < 1.1.0-r1
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 1.0.0-r0
- (no CPE)range: < 1.1.0-r1
- (no CPE)range: < 2.18.1-r8
- (no CPE)range: < 6.2.0-r2
- (no CPE)range: < 2.568.1-r1
- (no CPE)range: < 4.2.0-r1
- (no CPE)range: < 0.27.1-r16
- (no CPE)range: < 8.4.0.397-r0
- (no CPE)range: < 4.14.3-r0
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 4.0.2-r7
- (no CPE)range: < 4.3.1-r3
- (no CPE)range: < 2026.03.1-r1
- (no CPE)range: < 2026.06.0-r3
- (no CPE)range: < 5.26.28-r5
- (no CPE)range: < 3.6.2-r2
- (no CPE)range: < 1.1.0-r1
- (no CPE)range: < 2026.06.0-r3
- (no CPE)range: < 2.568.1-r1
- (no CPE)range: < 1.0.0-r0
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 1.1.0-r1
- (no CPE)range: < 6.14.5-r3
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 37.0.0-r47
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 0.27.1-r16
- (no CPE)range: < 2.18.1-r16
- (no CPE)range: < 8.4.0.397-r0
- (no CPE)range: < 8.4.0.382-r0
- (no CPE)range: < 4.14.3-r0
- (no CPE)range: < 10.0.0-r8
- (no CPE)range: < 10.0.0-r2
- (no CPE)range: < 10.0.0-r2
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 6.14.5-r1
- (no CPE)range: < 4.14.3-r0
- (no CPE)range: < 37.0.0-r47
- (no CPE)range: < 10.0.0-r8
- (no CPE)range: < 10.0.0-r8
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 1.1.0-r4
- (no CPE)range: < 4.14.3-r0
- (no CPE)range: < 2.568.1-r1
- (no CPE)range: < 1.1.0-r1
- (no CPE)range: < 1.1.0-r4
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-f4v5-65jj-pcr2ghsaADVISORY
- gitlab.eclipse.org/security/cve-assignment/-/work_items/119nvdVendor AdvisoryExploitWEB
- nvd.nist.gov/vuln/detail/CVE-2026-10051ghsaADVISORY
- github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8ebghsaWEB
- github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9ghsaWEB
- github.com/jetty/jetty.project/pull/15162ghsaWEB
- github.com/jetty/jetty.project/pull/15163ghsaWEB
- github.com/jetty/jetty.project/releases/tag/jetty-12.0.36ghsaWEB
- github.com/jetty/jetty.project/releases/tag/jetty-12.1.10ghsaWEB
- github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2ghsaWEB
News mentions
0No linked articles in our index yet.